Self-service device encryption key access

Abstract

Disclosed are various embodiments for providing access to a recovery key of a managed device and rotating the recovery key after it has been accessed. In one example, among others, a system includes a computing device and program instructions. The program instructions can cause the computing device to store a first recovery key for a first managed computing device. The first recovery key is configured to access an encrypted data store of the first managed computing device. A request is received for the first recovery key from a second managed computing device. The first recovery key is transmitted for display on the second managed computing device. A key rotation command is generated for a command queue of the first managed computing device to rotate the first recovery key after transmitting the first recovery key. The second recovery key is received from the second computing device.

Therefore, the following is claimed: 
     
       1. A system, comprising:
 a computing device; and 
 program instructions executable in the computing device that, when executed by the computing device, cause the computing device to:
 store a first recovery key for a first managed client device, wherein the first recovery key is configured to access an encrypted data store of the first managed client device; 
 receive a request for the first recovery key from a second managed client device, wherein the first managed client device and the second managed client device are associated with a managed user profile of a management service; 
 transmit the first recovery key for display to the second managed client device; 
 place a key rotation command into a command queue of the first managed client device, the key rotation command instructing the first managed client device to rotate the first recovery key in an instance in which the first recovery key has been transmitted; and 
 receive a second recovery key from the first managed client device. 
 
 
     
     
       2. The system of  claim 1 , wherein the key rotation command comprises an instruction for executing an application programming interface command of an operating system for generating the second recovery key. 
     
     
       3. The system of  claim 1 , further comprising program instructions executable in the computing device that, when executed, further cause the computing device to:
 generate an entry for an event log in an instance in which the first recovery key has been transmitted for display, wherein the entry comprises a time stamp for when the first recovery key was transmitted. 
 
     
     
       4. The system of  claim 1 , further comprising program instructions executable in the computing device that, when executed, further cause the computing device to:
 validate a credential provided by the second managed client device in an instance in which the request for the first recovery key has been received. 
 
     
     
       5. The system of  claim 1 , wherein the key rotation command comprises an instruction to rotate the first recovery key in an instance in which a period of time has expired from the first recovery key being transmitted to the second managed client device. 
     
     
       6. The system of  claim 1 , further comprising program instructions executable in the computing device that, when executed, further cause the computing device to:
 transmit the key rotation command to the first managed client device in an instance in which the first managed client device has become accessible on a network. 
 
     
     
       7. The system of  claim 6 , wherein the key rotation command comprises an instruction for the first management device to transmit the second recovery key to the computing device. 
     
     
       8. A non-transitory computer-readable medium embodying program instructions executable in at least one computing device that, when executed by the at least one computing device, cause the at least one computing device to:
 store a first recovery key for a first managed client device, wherein the first recovery key is configured to access an encrypted data store of the first managed client device; 
 receive a request for the first recovery key from a second managed client device, wherein the first managed client device and the second managed client device are associated with a managed user account of a management service; 
 transmit the first recovery key for display to the second managed client device; 
 place a key rotation command into a command queue of the first managed client device, the key rotation command instructing the first managed client device to rotate the first recovery key in an instance in which the first recovery key has been transmitted; and 
 receive a second recovery key from the first managed client device. 
 
     
     
       9. The non-transitory computer-readable medium of  claim 8 , wherein the key rotation command comprises an instruction for executing an application programming interface command of an operating system for generating the second recovery key. 
     
     
       10. The non-transitory computer-readable medium of  claim 8 , wherein the program instructions, when executed, further cause the at least one computing device to:
 generate an entry for an event log in an instance in which the first recovery key for display has been transmitted, wherein the entry comprises a time stamp for when the first recovery key was transmitted. 
 
     
     
       11. The non-transitory computer-readable medium of  claim 8 , wherein the program instructions, when executed, further cause the at least one computing device to:
 validate a credential provided by the second managed client device in an instance in which the request for the first recovery key has been received. 
 
     
     
       12. The non-transitory computer-readable medium of  claim 8 , wherein the key rotation command comprises an instruction to rotate the first recovery key in an instance in which a period of time has expired from the first recovery key being transmitted to the second managed client device. 
     
     
       13. The non-transitory computer-readable medium of  claim 8 , wherein the program instructions, when executed, further cause the at least one computing device to:
 transmit the key rotation command to the first managed client device in an instance in which the first managed client device has become accessible on a network. 
 
     
     
       14. The non-transitory computer-readable medium of  claim 13 , wherein the key rotation command comprises an instruction for the first managed client device to transmit the second recovery key to the at least one computing device. 
     
     
       15. A computer-implemented method, comprising:
 storing a first recovery key for a first managed client device, wherein the first recovery key is configured to access an encrypted data store of the first managed client device; 
 receiving a request for the first recovery key from a second managed client device, wherein the first managed client device and the second managed client device are associated with a managed user account of a management service; 
 transmitting the first recovery key for display to the second managed client device; 
 placing a key rotation command into a command queue of the first managed client device, the key rotation command instructing the first managed client device to rotate the first recovery key in an instance in which the first recovery key has been transmitted; and 
 receiving a second recovery key from the first managed client device. 
 
     
     
       16. The computer-implemented method of  claim 15 , wherein the key rotation command comprises an instruction for executing an application programming interface command of an operating system for generating the second recovery key. 
     
     
       17. The computer-implemented method of  claim 16 , further comprising:
 generating an entry for an event log in an instance in which the first recovery key for display has been transmitted, wherein the entry comprises a time stamp for when the first recovery key was transmitted. 
 
     
     
       18. The computer-implemented method of  claim 16 , further comprising:
 validating a credential provided by the second managed client device in an instance in which the request for the first recovery key has been received. 
 
     
     
       19. The computer-implemented method of  claim 15 , wherein the key rotation command comprises an instruction to rotate the first recovery key in an instance in which a period of time has expired from the first recovery key being transmitted to the second managed client device. 
     
     
       20. The computer-implemented method of  claim 15 , further comprising:
 transmit the key rotation command to the first managed client device in an instance in which the first managed client device has become accessible on a network.